US5263157A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and system for providing user access control within a distributed data processing system by the exchange of access control profiles
Assignee: International Business Machines Corp
•
Filing: 1990-02-15
•
Granted: 1993-11-16
•
Expires: 2010-02-15
Abstract
Abstract A method is disclosed for providing user access control for a plurality of resource objects within a distributed data processing system having a plurality of resource managers. A reference monitor service is established and a plurality of access control profiles are stored therein. Thereafter, selected access control profiles are exchanged between the reference monitor service and a resource manager in response to an attempted access of a particular resource object controlled by that resource manager. The resource manager may then control access to the resource object by utilizing the exchanged access control profile. In a preferred embodiment of the present invention, each access control profile may include access control information relating to a selected user; a selected resource object; a selected group of users; a selected set of resource objects; or, a predetermined set of resource objects and a selected group of users.
Inventors
- 👤 Frederick L. Janis
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 01:28
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/629; G06F21/6218; G06F2221/00; G06F2221/21; G06F2221/2141; Y; Y10; Y10S; Y10S707/00; Y10S707/99931; Y10S707/99939
Claims Analysis
Total Claims: 10
Claim 1
Independent Claim
297 words
A computer implemented method of providing user access control for a plurality of resource objects within a distributed data processing system having at least one reference monitor service and a plurality of resource managers associated with said plurality of resource objects, each of said plurality of resource managers controlling access to different selected ones of said resource objects, each of said resource managers associated with a reference monitor service, said method comprising the computer implemented steps of: storing a plurality of unique access control profiles within each said reference monitor service, wherein selected ones of said plurality of access control profiles each include access control information relating to a predetermined set of said resource objects and a selected list of users each authorized to access at least a portion of said predetermined set of resource objects; querying an associated reference monitor service by a selected one of said resource managers in response to an attempted access of a particular resource object among said plurality of resource objects, wherein access to said particular resource object is controlled by said selected resource manager; transmitting a selected access control profile associated with said particular resource object from said associated reference monitor service to said selected one of said resource managers if said selected access control profile existed in said associated reference monitor service; if not, attempting to retrieve said selected access control profile from another said reference monitor service and thereafter transmitting said retrieved access control profile to said selected one of said resource managers; utilizing said selected resource manager to control access to said particular resource object in accordance with access control information in said selected access control profile; and denying access to said particular resource object in response to a failure to retrieve said selected access control profile.
Claim 2
Dependent Claim
297 words
A computer implemented method of providing user access control for a plurality of resource objects within a distributed data processing system having at least one reference monitor service and a plurality of resource managers associated with said plurality of resource objects, each of said plurality of resource managers controlling access to different selected ones of said resource objects, each of said resource managers associated with a reference monitor service, said method comprising the computer implemented steps of: storing a plurality of unique access control profiles within each said reference monitor service, wherein selected ones of said plurality of access control profiles each include access control information relating to a predetermined set of said resource objects and a selected list of users each authorized to access at least a portion of said predetermined set of resource objects; querying an associated reference monitor service by a selected one of said resource managers in response to an attempted access of a particular resource object among said plurality of resource objects, wherein access to said particular resource object is controlled by said selected resource manager; transmitting a selected access control profile associated with said particular resource object from said associated reference monitor service to said selected one of said resource managers if said selected access control profile existed in said associated reference monitor service; if not, attempting to retrieve said selected access control profile from another said reference monitor service and thereafter transmitting said retrieved access control profile to said selected one of said resource managers; utilizing said selected resource manager to control access to said particular resource object in accordance with access control information in said selected access control profile; and denying access to said particular resource object in response to a failure to retrieve said selected access control profile.
Claim 3
Dependent Claim
47 words
The computer implemented method of providing user access control for a plurality of resource objects within a distributed data processing system according to claim 1 wherein selected ones of said plurality of access control profiles each include access control information relating to a selected group of users.
Claim 4
Dependent Claim
299 words
A computer implemented method of providing user access control for a plurality of resource objects within a distributed data processing system having a plurality of resource managers associated with said plurality of resource objects, each of said plurality of resource managers controlling access to different selected ones of said resource objects, said method comprising the steps of: establishing at least one reference monitor service within said distributed data processing system; associating each resource manager with a reference monitor service; storing a plurality of unique access control profiles within each said reference monitor service, wherein selected ones of said plurality of access control profiles each include access control information relating to a predetermined set of said resource objects and a selected list of users each authorized to access at least a portion of said predetermined set of resource objects; querying as associated reference monitor service by a selected one of said resource managers in response to an attempted access of a particular resource object among said plurality of resource objects, wherein access to said particular resource object is controlled by said selected resource manager; transmitting a selected access control profile associated with said particular resource object from said associated reference monitor service to said selected one of said resource managers if said selected access control profile existed in said associated reference monitor service; if not, attempting to retrieve said selected access control profile from another said reference monitor service and thereafter transmitting said retrieved access control profile to said selected one of said resource managers; utilizing said selected resource manager to control access to said particular resource object in accordance with access control information in said selected access control profile; and denying access to said particular resource object in response to a failure to retrieve said selected access control profile.
Claim 5
Dependent Claim
299 words
A computer implemented method of providing user access control for a plurality of resource objects within a distributed data processing system having a plurality of resource managers associated with said plurality of resource objects, each of said plurality of resource managers controlling access to different selected ones of said resource objects, said method comprising the steps of: establishing at least one reference monitor service within said distributed data processing system; associating each resource manager with a reference monitor service; storing a plurality of unique access control profiles within each said reference monitor service, wherein selected ones of said plurality of access control profiles each include access control information relating to a predetermined set of said resource objects and a selected list of users each authorized to access at least a portion of said predetermined set of resource objects; querying as associated reference monitor service by a selected one of said resource managers in response to an attempted access of a particular resource object among said plurality of resource objects, wherein access to said particular resource object is controlled by said selected resource manager; transmitting a selected access control profile associated with said particular resource object from said associated reference monitor service to said selected one of said resource managers if said selected access control profile existed in said associated reference monitor service; if not, attempting to retrieve said selected access control profile from another said reference monitor service and thereafter transmitting said retrieved access control profile to said selected one of said resource managers; utilizing said selected resource manager to control access to said particular resource object in accordance with access control information in said selected access control profile; and denying access to said particular resource object in response to a failure to retrieve said selected access control profile.
Claim 6
Dependent Claim
47 words
The computer implemented method of providing user access control for a plurality of resource objects within a distributed data processing system according to claim 3, wherein selected ones of said plurality of access control profiles each include access control information relating to a selected group of users.
Claim 7
Dependent Claim
306 words
A data processing system for providing user access control for a plurality of resource objects within a distributed data processing system having at least one reference monitor service and a plurality of resource managers associated with said plurality of resource objects, each of said plurality of resource managers controlling access to different selected ones of said resource objects, each of said resource managers associated with a reference monitor service, said data processing system comprising: means for storing a plurality of unique access control profiles within each said reference monitor service, wherein selected ones of said plurality of access control profiles each include access control information relating to a predetermined set of said resource objects and a selected list of users each authorized to access at lest a portion of said predetermined set of resource objects; means for querying an associated reference monitor service by a selected one of said resource managers in response to an attempted access of a particular resource object among said plurality of resource objects, wherein access to said particular resource object is controlled by said selected resource manager; means for transmitting a selected access control profile associated with said particular resource object from said associated reference monitor service to said selected one of said resource managers if said selected access control profile existed in said associated reference monitor service; and if not, for attempting to retrieve said selected access control profile from another said reference monitor service and thereafter transmitting said retrieved access control profile to said selected one of said resource managers; means for utilizing said selected resource manager to control access to said particular resource object in accordance with access control information in said selected access control profile; and means for denying access to said particular resource object in response to a failure to retrieve said selected access control profile.
Claim 8
Dependent Claim
306 words
A data processing system for providing user access control for a plurality of resource objects within a distributed data processing system having at least one reference monitor service and a plurality of resource managers associated with said plurality of resource objects, each of said plurality of resource managers controlling access to different selected ones of said resource objects, each of said resource managers associated with a reference monitor service, said data processing system comprising: means for storing a plurality of unique access control profiles within each said reference monitor service, wherein selected ones of said plurality of access control profiles each include access control information relating to a predetermined set of said resource objects and a selected list of users each authorized to access at lest a portion of said predetermined set of resource objects; means for querying an associated reference monitor service by a selected one of said resource managers in response to an attempted access of a particular resource object among said plurality of resource objects, wherein access to said particular resource object is controlled by said selected resource manager; means for transmitting a selected access control profile associated with said particular resource object from said associated reference monitor service to said selected one of said resource managers if said selected access control profile existed in said associated reference monitor service; and if not, for attempting to retrieve said selected access control profile from another said reference monitor service and thereafter transmitting said retrieved access control profile to said selected one of said resource managers; means for utilizing said selected resource manager to control access to said particular resource object in accordance with access control information in said selected access control profile; and means for denying access to said particular resource object in response to a failure to retrieve said selected access control profile.
Claim 9
Dependent Claim
312 words
A data processing system for providing user access control for a plurality of resource objects within a distributed data processing system having a plurality of resource managers associated with said plurality of resource objects, each of said plurality of resource managers controlling access to different selected ones of said resource objects, said data processing system comprising: means for establishing at least one reference monitor service within said distributed data processing system; means for associating each resource manager with a reference monitor service; means for storing a plurality of unique access control profiles within each said reference monitor service, wherein selected ones of said plurality of access control profiles each include access control information relating to a predetermined set of said resource objects and a selected list of users each authorized to access at least a portion of said predetermined set of resource objects; mean for querying an associated reference monitor service by a selected one of said resource managers in response to an attempted access of a particular resource object among said plurality of resource objects, wherein access to said particular resource object is controlled by said selected resource manager; means for transmitting a selected access control profile associated with said particular resource object from said associated reference monitor service to said selected one of said resource managers if said selected access control profile existed in said associated reference monitor service; if not, attempting to retrieve said selected access control profile from another said reference monitor service and thereafter transmitting said retrieved access control profile to said selected one of said resource managers; means for utilizing said selected resource manager to control access to said particular resource object in accordance with access control information in said selected access control profile; and means for denying access to said particular resource object in response to a failure to retrieve said selected access control profile.
Claim 10
Dependent Claim
312 words
A data processing system for providing user access control for a plurality of resource objects within a distributed data processing system having a plurality of resource managers associated with said plurality of resource objects, each of said plurality of resource managers controlling access to different selected ones of said resource objects, said data processing system comprising: means for establishing at least one reference monitor service within said distributed data processing system; means for associating each resource manager with a reference monitor service; means for storing a plurality of unique access control profiles within each said reference monitor service, wherein selected ones of said plurality of access control profiles each include access control information relating to a predetermined set of said resource objects and a selected list of users each authorized to access at least a portion of said predetermined set of resource objects; mean for querying an associated reference monitor service by a selected one of said resource managers in response to an attempted access of a particular resource object among said plurality of resource objects, wherein access to said particular resource object is controlled by said selected resource manager; means for transmitting a selected access control profile associated with said particular resource object from said associated reference monitor service to said selected one of said resource managers if said selected access control profile existed in said associated reference monitor service; if not, attempting to retrieve said selected access control profile from another said reference monitor service and thereafter transmitting said retrieved access control profile to said selected one of said resource managers; means for utilizing said selected resource manager to control access to said particular resource object in accordance with access control information in said selected access control profile; and means for denying access to said particular resource object in response to a failure to retrieve said selected access control profile.
References Cited (Backward Citations)
US4145739A
Cited
US4325120A
Cited
US4525780A
Cited
US4543638A
Cited
US4714989A
Cited
US4718005A
Cited
US4652698A
Cited
US4924378A
Cited
US5023907A
Cited
US5032979A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1996-11-15 | 1997-05-17 | 1997-11-16 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2000-11-15 | 2001-05-17 | 2001-11-16 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2004-11-15 | 2005-05-17 | 2005-11-16 | $7700.00 | Window Closed / Lapsed |